Privacy policy

Last updated: October 7, 2026

This policy describes how Transferable collects and processes personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.

Data controller

The data controller is Veltech, a société par actions simplifiée (French simplified joint-stock company) whose registered office is located at 22 allée Alan Turing, 63000 Clermont-Ferrand, France, registered under SIREN number 989 272 414.

For any question about the processing of your data, write to contact@transferable.io.

Data collected

  • Email address and username, provided when the account is created.
  • The files you upload to your library, and the metadata of your deliveries.
  • Billing data (name, address, country) and payment data, the latter processed directly by our payment provider and never stored on our servers.
  • Technical operating data: connection logs, IP address (in hashed form, for access control on deliveries), device type.

Purposes and legal basis

  • Providing the service (performance of the contract).
  • Billing and subscription management (performance of the contract, legal obligation).
  • Security and abuse prevention (legitimate interest).
  • Transactional notifications relating to your deliveries (performance of the contract).

Processors

To provide the service, we call on processors that process data on our behalf:

  • Vercel: hosting of the application (United States).
  • Stripe: payment and billing.
  • File storage and processing (European Union).
  • Database and authentication (European Union).
  • Sending of emails (European Union).
  • Bot protection (United States).
  • Address autocompletion (United States).

Some of these processors are established outside the European Union, or are liable to transfer data outside it. These transfers are governed by the European Commission's standard contractual clauses and, where applicable, by the data protection framework between the European Union and the United States (Data Privacy Framework).

A named list of our processors is available on request at contact@transferable.io.

Retention periods

  • Account data: for the entire duration of the contractual relationship, then five years under the limitation period.
  • Billing data: ten years, under accounting obligations.
  • Uploaded files: for the lifetime of the delivery and of the library, then purged thirty days after the user deletes them.
  • Anonymous visitor accounts: purged seven days after the last activity.
  • Technical logs: twelve months.

Your rights

You have a right of access, rectification, erasure, restriction, portability and objection. To exercise these rights, write to contact@transferable.io.

You may also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

This document is published in several languages. In the event of any discrepancy between versions, the French version prevails. The applicable law is French law.